What a bot farm is
Contents
Share
A bot farm, in the advertising conversation, is not one script and not one data center. The MRC addendum on invalid-traffic detection (final version, June 2020) gives a click farm as a case where non-robotic activity is organized and directed through many users or machines. That footnote belongs to the SIVT class: situations that are harder to notice. The same document also holds simple checks that are not a farm. Who clicks ads, and why, is a separate question. Here the point is the boundary of the term.
SIVT: what a list does not catch
The MRC document calls SIVT the situations that need advanced analysis, a comparison of several signals, or substantial human involvement. The examples include automation from a dedicated device and from an infected or taken-over device, incentivized human activity, forced clicks and accidental clicks from a spoofed interface, falsified measurement events, bots that disguise themselves, and invalid proxy traffic. The word IVT covers general invalid traffic and both classes together. Over time some SIVT can move into the routine class if standard lists appear.
A click farm in that footnote is organized activity of many people or machines, and it is precisely not “an obvious bot on a list.” The classification is for measuring advertising. It is not a description of how a farm is built and not a set of instructions for assembling one. The document asks not to mix disclosed reward programs that do not aim to falsify measurement into this category: a person who honestly watches an ad for an in-app bonus, and a person seated to click in order to distort measurement, are separated in the text.
What stays routine, and is not a farm
Beside SIVT the standard keeps a class recognized by lists and ordinary parameter checks: known data-center traffic with consistently invalid activity, bots and crawlers, a non-browser User-Agent, prefetch after which a person never opened the ad, sizes 0×0 and 1×1, and sessions that cannot render an image. The farm in the footnote does not fold into that list. A report that shows a data center is not yet a “click farm of people.” A report that shows many different users with one job — distort the measurement — is closer to the SIVT example, and one IP list is not enough: the document says these situations are harder to notice.
AdSense counts both auto-clicks and repeated people
Google AdSense help calls invalid traffic the clicks and impressions that can inflate an advertiser’s cost or a publisher’s earnings. The list includes both intentional fraud and accidental clicks. Among the examples are a publisher clicking its own live ads, repeated clicks or impressions by one or more users, calls to click, automated click tools, robots, and other misleading software. A click on a Google ad should come from genuine interest. Someone else can inflate traffic without the publisher knowing, and the help still leaves the responsibility with the publisher.
That is AdSense publisher policy, not farm statistics and not a Yandex Direct rule. There is no threshold of “how many repeats are already fraud,” so repeats by several users cannot automatically be named a farm: the help includes them among examples of invalid traffic and does not give a number.
A solved captcha is not proof of a person
The OWASP automated-threat catalog (OAT-009) expands CAPTCHA as a completely automated public Turing test that tells a computer from a person. The threat is named CAPTCHA Defeat: automation tries to obtain an answer to a visual or audio test, a mini-game, or an arithmetic task. The answer may come from machine reading or from a farm of people. In the editorial preface of 15 February 2018 the old name Bypass was replaced with Defeat: the puzzle is not skipped because of a broken install; it is solved, and against an interested attacker the test itself is ineffective. Those pages give no success rate. Service names and the solving procedure are not part of this description.
A farm of people in this definition is a way to beat a test, not a synonym for the MRC click farm. The same metaphor covers two places: advertising measurement, and solving a puzzle. A passed captcha does not separate organized clicks from live interest.
How to read the term without letting it spread:
If activity is organized through many people or machines in order to distort measurement, MRC places the example in the hard class, not on a list.
Do not call a data center, a crawler, or a 1×1 pixel this farm: the standard places them in routine checks.
Repeated clicks by several users in AdSense are an example of publisher invalid traffic, with no threshold and without the word “farm.”
A solved captcha can be the work of a human farm. The test by itself does not stop an interested attacker.
Do not promise yourself a floor plan, a payment scheme, or a share of such clicks: these sources do not have them.